Log why a Google callback could not finish

A failed Google callback has returned the visitor to /login?google=failed
since the previous release, but nothing recorded why: a declined consent,
an expired or missing state cookie and a forged request all looked the
same, and the log of the service held no entry at all.

GoogleSignInFailure now handles OnRemoteFailure. It writes one warning,
event GoogleSignInFailed (id 5), with the cause: the error code Google
reported, such as access_denied, or the reason the handler refused the
callback, such as "The oauth state was missing or invalid." An error code
is written only when it is a short run of letters, digits, '_', '-' and
'.'; anything else from the query string is written as an unrecognized
error. The authorization code, the state and tokens are never logged.
The redirect is unchanged.

Four new tests cover the entry, the redirect, an unusual error value and
a refused state. The account API document describes the log entry.

1 files changed, 6 insertions, 7 deletions

diff --git a/apps/api/Program.cs b/apps/api/Program.cs
index 688fe7d..31b46a2 100644
--- a/apps/api/Program.cs
+++ b/apps/api/Program.cs
@@ -45,13 +45,12 @@ if (!string.IsNullOrWhiteSpace(googleClientId) && !string.IsNullOrWhiteSpace(goo
         options.SignInScheme = AccountEndpoints.ExternalCookieScheme;
         options.SaveTokens = false;
         // A callback that cannot finish (the visitor declined on Google, or the state cookie is missing or
-        // expired) would otherwise end in an unhandled 500. The sign-in page explains a failed Google sign-in.
-        options.Events.OnRemoteFailure = context =>
-        {
-            context.Response.Redirect("/login?google=failed");
-            context.HandleResponse();
-            return Task.CompletedTask;
-        };
+        // expired) would otherwise end in an unhandled 500. The cause is logged, and the sign-in page explains
+        // a failed Google sign-in.
+        options.Events.OnRemoteFailure = context => GoogleSignInFailure.HandleAsync(
+            context,
+            context.HttpContext.RequestServices.GetRequiredService<ILoggerFactory>()
+                .CreateLogger(typeof(GoogleSignInFailure)));
     });
 }
 builder.Services.AddProblemDetails();